194.63.248.52 Threat Intelligence and Host Information
General
This page contains threat intelligence information for the IPv4 address 194.63.248.52 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.
🟠 Elevated — 70/100
Geographic Location
Host and Network Information
- View other sources: Spamhaus VirusTotal Shodan AbuseIPDB
- Country: Norway
- Noticed: 42 times
- Protocols Attacked: SSH
- Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
- Open Ports: 443, 80
- Tor Node: No
Tags
- access type
- active
- added active
- adversaries
- allocates rwx
- antivm network
- attack
- auto-generated security
- bad traffic
- borland delphi
- ck id
- click
- copyright
- create
- createfilew
- cve
- cyber security
- data
- date
- dead host
- deletes self
- delphi generic
- desktop
- empty hash
- encrypt files
- entries
- entropy
- error
- et info
- evader
- execution
- exe nolookup
- false
- filehashmd5
- filehashsha1
- file type
- flag
- france france
- general
- generic
- genericread
- genericwrite
- germany germany
- global
- gmt flag
- hkeyclassesroot
- hkeycurrentuser
- http header
- hybrid
- icons library
- informative
- inject
- installs
- intel
- ioc
- ipv4
- learn
- levelblue
- link library
- llc name
- maas
- malicious
- md5 code
- members
- mirai
- mitre att
- modules
- money doc
- monitor
- ms windows
- name tactics
- network icmp
- Nextray
- os2 executable
- overlay
- packer entropy
- path
- pe32
- pe32 compiler
- pe32 executable
- pe features
- persistence
- pe unknown
- phishing
- proxy wpad
- python
- ransom
- reevil
- registry
- regopenkeyexa
- regopenkeyexw
- regsetvalueexw
- related pulses
- remote
- resource name
- role title
- russsian data
- search
- server
- service
- show
- showing
- strings
- success
- suspicious
- tags
- target
- tcp traffic
- tools
- type indicator
- ukraine ukraine
- united
- united kingdom
- url http
- url https
- viet nam
- virtualallocex
- webview
- win16 ne
- win32 dynamic
- win32 exe
- windows
MITRE ATT&CK TTPs
- T1012 - Query Registry
- T1021 - Remote Services
- T1035 - Service Execution
- T1046 - Network Service Scanning
- T1055 - Process Injection
- T1060 - Registry Run Keys / Startup Folder
- T1083 - File and Directory Discovery
- T1112 - Modify Registry
- T1140 - Deobfuscate/Decode Files or Information
- T1179 - Hooking
- T1181 - Extra Window Memory Injection
- T1215 - Kernel Modules and Extensions
- T1547 - Boot or Logon Autostart Execution
- TA0002 - Execution
- TA0003 - Persistence
- TA0004 - Privilege Escalation
- TA0005 - Defense Evasion
- TA0008 - Lateral Movement
- TA0009 - Collection
- TA0010 - Exfiltration